Handling your data carefully and confidentially
Your health and your privacy are in safe hands with us. In this statement you can read which personal data we process, why we do so, how we protect your data and what rights you have. This is an English translation; in case of any difference, the Dutch version prevails.
1.Introduction
RytelZorg provides personal home care and elderly care in Voorburg, Leidschendam, Wassenaar, The Hague and the surrounding area. To provide good and safe care, we process personal data of clients, their legal representatives and contact persons, (prospective) staff and visitors to our website.
Health data are special categories of personal data and deserve extra protection. RytelZorg handles them carefully, confidentially and in accordance with applicable laws and regulations.
2.Data controller
RytelZorg is responsible for the processing of personal data as described in this privacy statement.
Parkweg
2271 BH Voorburg
The Netherlands
| Registration | Number |
|---|---|
| AGB Organisation (pgb) | 41546640 |
| AGB Organisation (Home care / Zvw) | 75756884 |
| Personal AGB code of care provider | 91134283 |
| Chamber of Commerce number | 94964386 |
| VAT number | NL005122664B03 |
3.Applicable laws and regulations
- General Data Protection Regulation (GDPR/AVG)
- GDPR Implementation Act (UAVG)
- Medical Treatment Contracts Act (WGBO, Dutch Civil Code book 7)
- Act on Additional Provisions for the Processing of Personal Data in Healthcare (Wabvpz)
- Healthcare Quality, Complaints and Disputes Act (Wkkgz)
- Healthcare Providers Admission Act (Wtza)
- Long-term Care Act (Wlz), Social Support Act 2015 (Wmo) and Health Insurance Act (Zvw), where applicable
4.Which personal data do we process?
Clients
- Identification data: name, date of birth, gender and citizen service number (BSN). The use of the BSN is required by law in healthcare (Wabvpz).
- Contact details: address, phone number, email address and details of contact persons or legal representatives.
- Health and care data: care file, care plan, assessment, reports by care professionals, medication and treatment data, insofar as necessary for care.
- Administrative data: care agreement, health insurer and policy number, pgb or Wlz data, claims and invoicing data.
Applicants and staff
- Name and contact details, CV, diplomas, BIG or qualification data, certificate of conduct (VOG) and data needed for the employment or contracting relationship.
Website visitors
- Data you enter yourself in a contact or registration form (such as name, email, phone number and your message).
- Technical data and cookies, only with your consent where required (see article 10).
5.Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing, planning and coordinating home care | Performance of the care agreement (art. 6(1)(b)) and necessary for the provision of care (art. 9(2)(h) GDPR in conjunction with art. 30 UAVG) |
| Keeping a care file | Legal obligation (WGBO, art. 6(1)(c)) |
| Claims and invoicing to the health insurer, care office, municipality or SVB (pgb) | Performance of the agreement and legal obligation |
| Quality monitoring, safety and complaint handling | Legal obligation (Wkkgz) and legitimate interest |
| Recruitment and selection of staff | Preparation of an agreement and legitimate interest |
| Answering questions via the website, phone or email | Legitimate interest / preparation of an agreement |
| Analytical and marketing cookies | Your consent (art. 6(1)(a)), which you can always withdraw |
We do not take decisions based solely on automated processing, and we never sell your data to third parties.
6.Professional secrecy and confidentiality
Our care professionals have a statutory duty of professional secrecy (art. 7:457 Dutch Civil Code and, where applicable, art. 88 BIG Act). All staff and contracted care professionals sign a confidentiality agreement. Only staff directly involved in your care have access to your file, and only insofar as necessary for their tasks.
7.Sharing with third parties
We only share your data if this is necessary for your care, if you give consent, or if the law requires us to. Possible recipients are:
- Your GP, specialist or other care providers involved (with your consent or implied consent for the treatment)
- Health insurers (Zvw), care offices (Wlz), municipalities (Wmo) and the Social Insurance Bank (pgb)
- Supervisory authorities, such as the Health and Youth Care Inspectorate (IGJ), where required by law
- Processors who support us, such as suppliers of our electronic client record, scheduling software, email, IT and hosting. We conclude a data processing agreement with them (art. 28 GDPR).
Where possible, data are processed within the European Economic Area (EEA). If a service provider processes data outside the EEA, this only happens with appropriate safeguards, such as an adequacy decision or the standard contractual clauses of the European Commission.
8.Retention periods
| Data | Retention period | Legal basis |
|---|---|---|
| Care file (medical and care data) | At least 20 years after the last change, or longer if reasonably necessary for good care | Legal obligation – art. 7:454(3) Dutch Civil Code (WGBO) |
| Financial and tax records | At least 7 years | Legal obligation – art. 52 AWR / art. 2:10 Dutch Civil Code |
| Payroll records and copies of staff ID | At least 7 years (payroll records) and 5 years after leaving employment (copy of ID) | Legal obligation – tax legislation (Wage Tax Act) |
| Other personnel records | 2 years after leaving employment | Guideline of the Dutch Data Protection Authority |
| Application data | 4 weeks after the procedure ends, or 1 year with your consent | Guideline of the Dutch Data Protection Authority |
| Contact requests via the website, email or WhatsApp without a care relationship | As long as needed to handle them, no later than 1 year after the last contact | GDPR – not kept longer than necessary |
After the retention period, data are carefully destroyed or anonymised.
9.Security
We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access:
- A secure electronic client record with personal login and two-factor authentication
- Role-based access ("need-to-know") and logging of who has viewed a file
- Encrypted connections (SSL/TLS) on our website and in our systems
- Confidentiality agreements, privacy instructions and awareness training for staff
- Data processing agreements with all suppliers who process personal data
- An internal protocol for reporting and handling security incidents
10.Website, cookies and WhatsApp
Cookies
Our website uses functional cookies that are needed for the site to work properly. We only place analytical and marketing cookies, for example to measure the results of our Google Ads advertisements, after you give consent via the cookie banner. You can change your choice at any time via the cookie settings at the bottom of the website.
Contact forms
We only use data you send via a form to handle your question or registration.
You can reach us via WhatsApp for practical questions and a first introduction. WhatsApp is a service of Meta. We advise you not to share medical or other sensitive information via WhatsApp. We prefer to discuss such information by phone or in person, or via a secure channel.
11.Your rights
You have the following rights:
- Access and copy of your data and your care file (art. 15 GDPR, art. 7:456 Dutch Civil Code)
- Correction or addition of incorrect data, and adding your own statement to your file (art. 16 GDPR, art. 7:454 Dutch Civil Code)
- Destruction of (parts of) your care file (art. 7:455 Dutch Civil Code), unless a legal obligation or a substantial interest of another person prevents this
- Restriction of processing (art. 18 GDPR)
- Portability of your data (art. 20 GDPR)
- Objection to processing based on legitimate interest (art. 21 GDPR)
- Withdrawal of consent, at any time and without giving reasons
You can send your request to info@rytelzorg.nl. To prevent misuse, we ask you to prove your identity. We respond within one month. For complex requests this period may be extended by up to two months; we will then tell you why.
12.Data breaches
If, despite our measures, a data breach occurs, we report it to the Dutch Data Protection Authority within 72 hours where required (art. 33 GDPR). If the breach is likely to pose a high risk to you, we inform you as soon as possible (art. 34 GDPR). Every incident is registered and evaluated internally.
13.Questions and complaints
Do you have a question or complaint about the way we handle your data? Please contact us first via info@rytelzorg.nl or 06 14 97 58 70. We are happy to resolve it together with you.
If we cannot resolve it together, you can:
- submit a complaint under our complaints procedure (Wkkgz), including the independent complaints officer and disputes committee to which RytelZorg is affiliated;
- submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
14.Changes
We may amend this privacy statement, for example in the event of new legislation or new services. The most recent version is always available on our website. We actively inform our clients of important changes.
Free care check (online simulation)
The free care check on rytelzorg.nl lets you see which schemes you can have assessed. While you fill it in, your answers stay only in your browser; nothing is sent to RytelZorg.
Only if you then choose support from RytelZorg and give your consent do we receive your name, the date of birth of the person needing care, your email address and phone number. We only receive your answers about the care situation, which may contain health data, with your separate, explicit consent.
Purpose: to review your contact request and contact you. Legal basis: your consent. The data is sent by e-mail to the RytelZorg mailbox (Gmail, Google) and read only by authorised staff. After sending, the website keeps no copy; only if sending fails is the request kept encrypted and deleted automatically after 30 days. We delete the e-mail once your request has been handled. We do not sell or share this data and do not send your answers to an AI service. To withdraw consent or request deletion: info@rytelzorg.nl, stating your reference.
© 2026 RytelZorg Home Care & Elderly Care · Parkweg, 2271 BH Voorburg · KvK 94964386